Skip to content
traveldistro home

Platform

Security

What is it

Every traveldistro API request is signed with HMAC-SHA256. The Authorization header carries your key id and signature, a timestamp limits the replay window to 300 seconds, and a single-use nonce rejects replays outright.

Capabilities

  • Signed requests

    Signatures cover method, path, query, timestamp, nonce and body hash. A tampered request fails verification.

  • Keys and rotation

    Keys are provisioned per agency and environment, and can be rotated without downtime.

  • Signed webhooks

    Deliveries to your endpoint carry their own HMAC signature, timestamp and delivery id for deduplication.

Request signing

signature = HMAC_SHA256(secret,
  METHOD + "\n" + PATH + "\n" + QUERY_SORTED + "\n" +
  TIMESTAMP + "\n" + NONCE + "\n" + SHA256_HEX(BODY))

Authorization: TD-HMAC-SHA256 KeyId=key_29xk, Signature=<hex>
X-TD-Timestamp: 1785603201
X-TD-Nonce: 1f7a-4c09

Frequently asked questions

Why not Bearer tokens?
A stolen bearer token replays anywhere. An HMAC signature is bound to one request, one timestamp and one nonce.
What about IP allowlisting?
Production keys can be locked to your infrastructure's IP ranges on request.

Related pages

Ready to integrate?

Tell us about your volume and verticals. We will get you sandbox keys.

Contact us